Authenticated user on web app, using other people's id to update or change their information. So basically the web app is not checking for person who is logged in against the person who he/she is updating the information. Is there specific name for this type of attack?
To me it sounds like IDOR, Insecure Direct Object Reference, which OWASP defines as, "Insecure Direct Object References occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources in the system directly, for example database records or files. Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system, and more. This is caused by the fact that the application takes user supplied input and uses it to retrieve an object without performing sufficient authorization checks". I think IDOR sounds very similar to Broken Access Control, but i think this case is a case of IDOR.
...sounds to me like Improper Access Control.
Description Summary The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Extended Description Access control involves the use of several protection mechanisms such as authentication (proving the identity of an actor) authorization (ensuring that a given actor can access a resource), and accountability (tracking of activities that were performed). When any mechanism is not applied or otherwise fails, attackers can compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses:
Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
However, you don't mention how the actor is carrying out their attack - so I can only guess they are using GET parameter manipulation to impersonate another user.
In this case the actual attack would be "Parameter Manipulation" or "Parameter Tampering".
I always use the Web Application Security Consortium classification. You may use it to classify the threat regarding two of its aspects:
Attack (the method used to achieve the result) and
Weakness (the flaw that was exploited by the attack)
Using that classification, the attack should be categorized as Abuse of Functionality (as you are entitled to change your own information, but not other's) and the weakness as Insufficient Process Validation (as the application should know that that info belong's to someone else and that you're not allowed to change it).
However, I feel that the method -- not the damage -- should be named. Therefore, I would simply refer to this as an authentication bypass.